MAL-2025-192203

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/elf-stats-cocoa-ribbon-476/MAL-2025-192203.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2025-192203
Published
2025-12-03T16:50:41Z
Modified
2025-12-23T19:11:18.536121Z
Summary
Malicious code in elf-stats-cocoa-ribbon-476 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (005ed1613dc4777b86a0449d32f014ea40f1ab9237ebd84bed9d955cdbaefd56)

The package elf-stats-cocoa-ribbon-476 was found to contain malicious code.

Source: ossf-package-analysis (4634f9dee93f806a074705a1dcdcb30d630fa3a68ea61bc2c2d4e9a9510128af)

The OpenSSF Package Analysis project identified 'elf-stats-cocoa-ribbon-476' @ 3.0.0 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

  • The package executes one or more commands associated with malicious behavior.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2025-12-03T17:09:19.123168655Z",
            "sha256": "4634f9dee93f806a074705a1dcdcb30d630fa3a68ea61bc2c2d4e9a9510128af",
            "source": "ossf-package-analysis",
            "modified_time": "2025-12-03T16:50:41Z",
            "versions": [
                "3.0.0"
            ]
        },
        {
            "import_time": "2025-12-03T18:10:08.314502915Z",
            "sha256": "005ed1613dc4777b86a0449d32f014ea40f1ab9237ebd84bed9d955cdbaefd56",
            "source": "amazon-inspector",
            "modified_time": "2025-12-03T17:50:51Z",
            "versions": [
                "3.0.0"
            ]
        },
        {
            "id": "RLMA-2025-06157",
            "import_time": "2025-12-23T19:07:09.707482855Z",
            "sha256": "c3e45078cc17d31dbc0ad1610fd24596140225c8e74bcdb6f861a20b39ec0df2",
            "source": "reversing-labs",
            "modified_time": "2025-12-23T08:07:01Z",
            "versions": [
                "2.0.0",
                "3.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / elf-stats-cocoa-ribbon-476

Package

Name
elf-stats-cocoa-ribbon-476
View open source insights on deps.dev
Purl
pkg:npm/elf-stats-cocoa-ribbon-476

Affected ranges

Affected versions

2.*
2.0.0
3.*
3.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/elf-stats-cocoa-ribbon-476/MAL-2025-192203.json"